Issue #2822499 by klausi: CsrfTokenGenerator should use timing attack safe string comparison

core/lib/Drupal/Core/Access/CsrfAccessCheck.php

@@ -54,7 +54,7 @@ public function access(Route $route, Request $request, RouteMatchInterface $rout
       $path = str_replace("{{$param}}", $value, $path);
     }
 
-    if ($this->csrfToken->validate($request->query->get('token'), $path)) {
+    if ($this->csrfToken->validate($request->query->get('token', ''), $path)) {
       $result = AccessResult::allowed();
     }
     else {

core/lib/Drupal/Core/Access/CsrfTokenGenerator.php

@@ -87,7 +87,7 @@ public function validate($token, $value = '') {
       return FALSE;
     }
 
-    return $token === $this->computeToken($seed, $value);
+    return Crypt::hashEquals($this->computeToken($seed, $value), $token);
   }
 
   /**